Do not accept CSS-wide keywords for descriptors

third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserFastPaths.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSValuePool.h"
 #include "core/css/parser/CSSParserIdioms.h"
@@ skipping 826 matching lines @@
 
     if (!CSSParserFastPaths::isKeywordPropertyID(propertyId)) {
         // All properties accept the values of "initial" and "inherit".
         String lowerCaseString = string.lower();
         if (lowerCaseString != "initial" && lowerCaseString != "inherit")
             return nullptr;
 
         // Parse initial/inherit shorthands using the CSSPropertyParser.
         if (shorthandForProperty(propertyId).length())
             return nullptr;
+
+        // Descriptors do not support css wide keywords.
+        if (CSSPropertyMetadata::isDescriptor(propertyId))

[Timothy Loh, 2016/05/19 05:44:42]

Maybe this check should just be at the top of the function. font-display is
apparently handled by the keyword fast path currently.

[rwlbuis, 2016/05/20 00:51:11]

This was placed here to minimize calls to isDescriptor. I can still move it if
you want.

+            return nullptr;
     }
 
     CSSParserString cssString;
     cssString.init(string);
     CSSValueID valueID = cssValueKeywordID(cssString);
 
     if (!valueID)
         return nullptr;
 
     if (valueID == CSSValueInherit)
@@ skipping 174 matching lines @@
     if (isColorPropertyID(propertyID))
         return parseColor(string, parserMode);
     if (CSSValue* keyword = parseKeywordValue(propertyID, string, parserMode))
         return keyword;
     if (CSSValue* transform = parseSimpleTransform(propertyID, string))
         return transform;
     return nullptr;
 }
 
 } // namespace blink